Millions of Connected Cameras Open to Eavesdropping

[silversurfer]

Content source

https://threatpost.com/millions-connected-cameras-eavesdropping/166950/

Millions of connected security and home cameras contain a critical software vulnerability that can allow remote attackers to tap into video feeds, according to a warning from the Cybersecurity and Infrastructure Security Agency (CISA).

The bug (CVE-2021-32934, with a CVSS v3 base score of 9.1) has been introduced via a supply-chain component from ThroughTek that’s used by several original equipment manufacturers (OEMs) of security cameras – along with makers of IoT devices like baby- and pet-monitoring cameras, and robotic and battery devices.

The potential issues stemming from unauthorized viewing of feeds from these devices are myriad: For critical infrastructure operators and enterprises, video-feed interceptions could reveal sensitive business data, production/competitive secrets, information on floorplans for use in physical attacks, and employee information. And for home users, the privacy implications are obvious.

In its alert, issued Tuesday, CISA said that so far, no known public exploits are targeting the bug in the wild yet.

Millions of Connected Cameras Open to Eavesdropping

A supply-chain component lays open camera feeds to remote attackers thanks to a critical security vulnerability.

threatpost.com

 

[NetrunnerEdge]

Never thought a breach of this scale is possible with such a developed industry dedicated to the prevention of such attacks but here we are. Attacks like these are reasons why companies and organizations should invest more in cybersecurity-related research and take such matters seriously.

 

[Digmor Crusher]

If they want to hack into my cameras and look out at my street, have at er.

 

[upnorth]

for home users, the privacy implications are obvious.

IoT camera bugs are hardly rare: Last month, for instance, owners of Eufy home-security cameras were warned of an internal server bug that allowed strangers to view, pan and zoom in on their home-video feeds. Customers were also suddenly given access to do the same to other users.

These issues are way more serious then one can imagine. It's a real genuine problem and the Ring scandal wasn't too long ago with lowlifes, attacking children.

Ring and Amazon get slammed with a federal lawsuit that claims the companies failed to secure cameras against hackers

The company has been accused of negligence and breach of implied contract for failing to properly protect its users against cyberattack.

www.businessinsider.com